---
id: in
title: in Search Operator
sidebar_label: in
description: Use the in operator to check if a field's value matches any value in a specified list and return a boolean result.
slug: /help/docs/search/search-query-language/search-operators/in/
canonical: https://www.sumologic.com/help/docs/search/search-query-language/search-operators/in/
---

import useBaseUrl from '@docusaurus/useBaseUrl';

The `in` operator returns a Boolean value: true if the specified property is in the specified object, or false if it is not.

## Syntax

`<field> in (<value_1>[, <value_2>, <value_3>, ...])`

In the syntax, we are checking the value of the field provided for the \<field\> argument.

If the value of `<field>` matches any of value arguments (`<value_1>, <value_2>, ...`) the function will return true. Otherwise, it will return false.

## Examples

### Find 5xx or 4xx errors, otherwise OK message

The following query:

```sumo
_sourceCategory=Apache/Access
| parse "GET * HTTP/1.1\" * * \"*\"" as url, status_code, size, referrer
| if (status_code in ("500", "501", "502", "503", "504", "505", "506", "401", "402", "403", "404"), "error", "OK message") as reason
```

would return results similar to:

<img src={useBaseUrl('img/search/searchquerylanguage/search-operators/in.png')} alt="in search operator" style={{border: '1px solid gray'}} width="800" />

### Filter rows using where with in

Use `in` with `where` to restrict results to rows matching a set of known values:

```sumo
_sourceCategory=Apache/Access
| parse "GET * HTTP/1.1\" *" as url, status_code
| where status_code in ("200", "201", "204")
```